CVE-2016-3720 in com.fasterxml.jackson dependencies

[ajlanghorn]

When running the OWASP Dependency Check tool against a Dropwizard 0.9.2 installation, CVE-2016-3720 is raised thirteen times because of the fasterxml.jackson dependency:

jackson-annotations-2.6.0.jar (com.fasterxml.jackson.core:jackson-annotations:2.6.0, cpe:/a:fasterxml:jackson:2.6.0) : CVE-2016-3720
jackson-core-2.6.5.jar (com.fasterxml.jackson.core:jackson-core:2.6.5, cpe:/a:fasterxml:jackson:2.6.5) : CVE-2016-3720
jackson-databind-2.6.5.jar (com.fasterxml.jackson.core:jackson-databind:2.6.5, cpe:/a:fasterxml:jackson:2.6.5) : CVE-2016-3720
jackson-dataformat-yaml-2.6.3.jar (com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-datatype-guava-2.6.3.jar (com.fasterxml.jackson.datatype:jackson-datatype-guava:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-datatype-jdk7-2.6.3.jar (com.fasterxml.jackson.datatype:jackson-datatype-jdk7:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-datatype-jdk8-2.6.3.jar (com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-datatype-joda-2.6.3.jar (com.fasterxml.jackson.datatype:jackson-datatype-joda:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-datatype-jsr310-2.6.5.jar (com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.6.5, cpe:/a:fasterxml:jackson:2.6.5) : CVE-2016-3720
jackson-jaxrs-base-2.6.3.jar (com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-jaxrs-json-provider-2.6.3.jar (com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-module-afterburner-2.6.3.jar (com.fasterxml.jackson.module:jackson-module-afterburner:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720
jackson-module-jaxb-annotations-2.6.3.jar (com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.6.3, cpe:/a:fasterxml:jackson:2.6.3) : CVE-2016-3720

We'd rather not patch the version in 0.9.2, especially when 1.0.0 has RCs out. It looks like 1.0.0-rc3 will pull FasterXML.Jackson's latest version, rather than pinning it, so we're hopeful this will provide a fix.

[ajlanghorn]

@joschi Thanks for the super-speedy work on this! So awesome. In ec8a15c, it looks like you upgraded the Jackson version to 2.6.7 but noted in the commit message and readme that you'd gone to 2.6.5. Was that intentional?

[joschi]

@ajlanghorn Argh, that was a typo. Thanks for spotting it!

[ajlanghorn]

@joschi Do you happen to have a date for a 0.9.3 release so we don't need to build from master? :)

[ajlanghorn]

Oh, just noticed it's there!